Sunday, March 8, 2015

OpenStack - Projects, Users And Roles


As an OpenStack System Administrator, it is common to have new tenants.  To create new project, log into OpenStack (I am using my DevStack environment) as the admin user and select "Users" under the Identity Panel (on the left-hand side)


Click on the "Create User" button and fill in the required information on the pop-up window.



Click on the "+" button for the "Primary Project" field to create new project for the new user and fill in the Project Information.  Click on the "Create Project" button to create the new project.



We will see the green box on the top right-hand corner of the screen which says that the new project has been created.



The default role for the new user is "member".  We can select different roles for the users, e.g. admin based on our needs.  In my case, I have left it as member.



Next, go back to the Identity Panel and select the Project tab.  We should see the new project, i.e. Test1 on the project list now.



Select "Edit Project" for the newly created project and check that the new user is shown in the "Project Members" tab:




Lastly, check that you can log into Horizon using the new user.  You should see that you are inside the new project, i.e. Test1 in my case:




In this way you will be able to manage new tenants =)

4 comments:

Unknown said...

Hello,
I really appreciate your work, i am a Ph.D. student and i am researching cloud signalling, all of your posts are tip top at the spot, work flawless.
I have one question can you post how can i restart a machine that has devstack as you installed. I need that in order to modify the hardware specifications of the VM ( have more computational power at school).
Thanks, Eduard

Juncheng Anthony Lin said...

Hi Eduard,

Thanks for your kind remarks. If I understand your question correctly, you need to shut down your machine in order to increase its compute power. The issue will then be on how to reboot the machine and still be able to restore the previous devstack environment with the VMs intact.

I have thought about it for the past 2 days and spoke to some of my colleagues. I tested the below steps in another devstack environment with only Nova, Neutron, Cinder, Ceilometer and Cinder on it. And the VMs survived system reboot.

The steps are as follows:

1) Shut down the Virtual Machine with DevStack running on it

$ sudo init 0


2) Start up the machine in VirtualBox
3) Using the root user, make the following changes to the ownership of the following folders:

$ sudo -i
$ chown stack:stack /etc/ceilometer/
$ chown stack:stack /etc/neutron/
$ chown stack:stack /etc/nova/
$ chown stack:stack /etc/cinder/
$ chown stack:stack /etc/keystone/


4) As stack user, go into the devstack folder (this is the folder where the local.conf, stack.sh are stored)
5) Execute the rejoin-stack.sh

$ cd
$ cd devstack/
$ ./rejoin-stack.sh


6) Open a new Firefox window and log into the Horizon dashboard and you should see that the VMs are in shutdown state

7) Start up the VM and check that you can still access the console

I performed the steps and were able to recover my VMs after reboot (I tried 2 times and it worked on both occasions). I would suggest you to test these steps on a new devstack environment with dummy VMs and see if it works for your environment. Please let me know if this works for you as I realized that most of the methods that are posted online does not work at all (please do not run unstack.sh as suggested by some as it will destroy your environment)

I will probably write a new post on it if this works.

Thanks.

/Anthony

Unknown said...

The console work's but the floating ip's don't, you can not reach any floating ip not even the router.

Juncheng Anthony Lin said...

Hi, I went to look at the OpenStack settings and it seems that the security group for ICMP was missing after the reboot (I am not sure if this is the case for you). I was able to ping the floating IPs of the VMs and the router gateway using the console of the VM after adding the ICMP rules.

However, I was not able to ping the router gateway from the DevStack Host machine. This seems to be similar to an issue that was reported some time back. The problem seems to be related to routes but it was not mentioned if this fixes the problem and what routes were missing.

http://lists.openstack.org/pipermail/openstack-dev/2013-November/020725.html


Are you seeing similar behavior?


/Anthony